Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,508cataloged exploits

40,258CVEs with public exploitation

24,696lab-tested

All Referência 26,095Exploit-DB 24,488GitHub PoC 17,831VulnCheck XDB 10,015Nuclei 4,547Metasploit 3,532✓ verified onlyrecent popular risk

26,095 exploits

Referência✓ VexDay Proof

Limbo CMS 1.0.4.2L - 'com_contact' Remote Code Execution

CVE-2006-4859—webappsphp

Unrestricted file upload vulnerability in contact.html.php in the Contact (com_contact) component in Limbo (aka Lite Mam

23RISK

open ↗

Referência

CVE-2026-63100

CVE-2026-63100HIGH

Maybe 0.6.0 Missing Authorization via HostingsController show/update

41RISK

open ↗

Referência

CVE-2026-11575

CVE-2026-11575HIGH

PhonePe Payment Solutions < 3.1.0 - Unauthenticated Payment Bypass via Forged Callback

41RISK

open ↗

Referência

CVE-2026-97315

CVE-2026-97315MEDIUM

Responsive Blocks < 2.3.0 - Unauthenticated HTML Injection in Form Notification Email

33RISK

open ↗

Referência✓ VexDay Proof

Advanced Webhost Billing System (AWBS) 2.7.1 - 'news.php' SQL Injection

CVE-2008-2903—webappsphp

SQL injection vulnerability in news.php in Advanced Webhost Billing System (AWBS) 2.3.3 through 2.7.1, when magic_quotes

23RISK

open ↗

Referência

CVE-2026-88998

CVE-2026-88998MEDIUM

Tickera < 3.6.0.4 - Unauthenticated Order Payment Bypass via 2Checkout IPN

33RISK

open ↗

Referência

CVE-2016-1794

CVE-2016-1794—

The AppleGraphicsControlClient::checkArguments method in AppleGraphicsControl in Apple OS X before 10.11.5 allows attack

23RISK

open ↗

Referência

CVE-2016-1794

CVE-2016-1794—

The AppleGraphicsControlClient::checkArguments method in AppleGraphicsControl in Apple OS X before 10.11.5 allows attack

23RISK

open ↗

Referência

CVE-2006-5190

CVE-2006-5190—

Multiple cross-site scripting (XSS) vulnerabilities in osCommerce 2.2 Milestone 2 Update 060817 allow remote attackers t

23RISK

open ↗

Referência

CVE-2006-5191

CVE-2006-5191—

PHP remote file inclusion vulnerability in includes/functions_static_topics.php in the Nivisec Static Topics module for

23RISK

open ↗

Referência✓ VexDay Proof

WebChamado 1.1 - Arbitrary Add Admin

CVE-2008-2907—webappsphp

SQL injection vulnerability in admin/index.php in WebChamado 1.1, when magic_quotes_gpc is disabled, allows remote attac

23RISK

open ↗

Referência✓ VexDay Proof

Discussion Forums 2k 3.3 - Multiple SQL Injections

CVE-2008-6100—webappsphp

Multiple SQL injection vulnerabilities in Discussion Forums 2k 3.3, when magic_quotes_gpc is disabled, allow remote atta

23RISK

open ↗

Referência

CVE-2008-6101

CVE-2008-6101—

SQL injection vulnerability in click.php in Adult Banner Exchange Website allows remote attackers to execute arbitrary S

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component Thyme 1.0 - SQL Injection

CVE-2008-6116—webappsphp

SQL injection vulnerability in the EXtrovert Software Thyme (com_thyme) 1.0 component for Joomla! allows remote attacker

23RISK

open ↗

Referência

CVE-2012-2740

CVE-2012-2740—

SQL injection vulnerability in public_html/lists/admin in phpList before 2.10.18 allows remote attackers to execute arbi

23RISK

open ↗

Referência✓ VexDay Proof

WebYep 1.1.9 - 'webyep_sIncludePath' File Inclusion

CVE-2006-5220—webappsphp

Multiple PHP remote file inclusion vulnerabilities in WebYep 1.1.9, when register_globals is enabled, allow remote attac

28RISK

open ↗

Referência✓ VexDay Proof

ASPilot Pilot Cart 7.3 - 'article' SQL Injection

CVE-2008-2688—webappsasp

SQL injection vulnerability in pilot.asp in ASPilot Pilot Cart 7.3 allows remote attackers to execute arbitrary SQL comm

23RISK

open ↗

Referência

CVE-2021-42237

CVE-2021-42237CRITICALunder attackransomware

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it

100RISK

open ↗

Referência✓ VexDay Proof

MyBloggie 2.1.6 - Multiple SQL Injections

CVE-2008-3080—webappsphp

Cross-site request forgery (CSRF) vulnerability in admin.php in myWebland myBloggie 2.1.6 allows remote attackers to per

23RISK

open ↗

Referência✓ VexDay Proof

Harlandscripts drinks - 'recid' SQL Injection

CVE-2008-6233—webappsphp

SQL injection vulnerability in index.php in Five Dollar Scripts Drinks script allows remote attackers to execute arbitra

23RISK

open ↗

Referência✓ VexDay Proof

Active NewsLetter 4.3 - Authentication Bypass

CVE-2008-6286—webappsasp

Multiple SQL injection vulnerabilities in SubscriberStart.asp in Active Newsletter 4.3 allow remote attackers to execute

23RISK

open ↗

Referência

CVE-2026-109115

CVE-2026-109115MEDIUM

AdithyaYelloju Restaurant-Management-System Password Reset forgot3.php sql injection

33RISK

open ↗

Referência

CVE-2009-4627

CVE-2009-4627—

Directory traversal vulnerability in sources/_template_parser.php in Moa Gallery 1.2.0 and earlier allows remote attacke

23RISK

open ↗

Referência

CVE-2016-3115

CVE-2016-3115MEDIUM

Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to

45RISK

open ↗

Referência✓ VexDay Proof

P-Book 1.17 - 'pb_lang' Remote File Inclusion

CVE-2006-5667—webappsphp

Multiple PHP remote file inclusion vulnerabilities in P-Book 1.17 and earlier allow remote attackers to execute arbitrar

23RISK

open ↗

Referência

CVE-2026-109114

CVE-2026-109114MEDIUM

AdithyaYelloju Restaurant-Management-System Login Form login.php improper authentication

33RISK

open ↗

Referência

CVE-2008-6392

CVE-2008-6392—

SQL injection vulnerability in showads.php in Z1Exchange allows remote attackers to execute arbitrary SQL commands via t

23RISK

open ↗

Referência

CVE-2016-1105

CVE-2016-1105—

Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsof

35RISK

open ↗

Referência

CVE-2026-14210

CVE-2026-14210MEDIUM

Insufficient Granularity of Access Control in GitLab

33RISK

open ↗

Referência✓ VexDay Proof

Essentia Web Server 2.15 - GET Remote Denial of Service

CVE-2006-5850—doswindows

Stack-based buffer overflow in Essentia Web Server 2.15 for Windows allows remote attackers to execute arbitrary code vi

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.